Event ID 4000: Message Queue Growth - Fix Guide 2025

Log Name:      Application
Source:        MSExchangeTransport
Event ID:      4000
Level:         Warning
Description:   Queue "mail.partner.com" has grown to 2,847 messages.
               This queue has been in retry status for 00:45:00.
               Last retry error: Connection refused by remote server.

# Retry all queues in Retry status
Get-Queue | Where-Object {$_.Status -eq "Retry"} | Retry-Queue

# Retry specific queue
Retry-Queue -Identity "SERVERNAME\partner.com"

# Force immediate connection attempt
Get-Queue | Where-Object {$_.MessageCount -gt 100} | Retry-Queue -Resubmit $true

# Configure reliable external DNS
Set-TransportService $env:COMPUTERNAME -ExternalDNSServers 8.8.8.8,1.1.1.1

# Clear DNS cache
Clear-DnsClientCache
ipconfig /flushdns

# Restart Transport to apply
Restart-Service MSExchangeTransport

# Retry queues
Get-Queue | Where-Object {$_.Status -eq "Retry"} | Retry-Queue

# If direct delivery failing, route through smart host
# Create or modify send connector
Set-SendConnector "Internet Send Connector" `
  -SmartHosts "smtp-relay.company.com" `
  -DNSRoutingEnabled $false

# Or create domain-specific connector
New-SendConnector -Name "Partner via SmartHost" `
  -AddressSpaces "SMTP:partner.com;1" `
  -SmartHosts "smtp-relay.company.com" `
  -DNSRoutingEnabled $false

# Identify spam in queue
Get-Queue | Get-Message -ResultSize 100 |
  Group-Object FromAddress |
  Sort-Object Count -Descending |
  Select-Object Count, Name

# Remove messages from specific sender (if spam)
# Get-Queue | Get-Message -Filter {FromAddress -like "*spam@*"} |Get-Message -Filter {FromAddress -like "*spam@*"} |
#   Remove-Message -WithNDR $false -Confirm:$false-WithNDR $false -Confirm:$false

# Remove old stuck messages (older than 24 hours)
# Get-Queue | Get-Message |Get-Message |
#   Where-Object {$_.DateReceived -lt (Get-Date).AddHours(-24)} |$_.DateReceived -lt (Get-Date).AddHours(-24)} |
#   Remove-Message -WithNDR $true-WithNDR $true

# Check if target database is mounted
Get-MailboxDatabase -Status | Select-Object Name, Mounted, Server

# If database is dismounted, mount it
Mount-Database "Mailbox Database 01"

# Check database replication status (DAG)
Get-MailboxDatabaseCopyStatus | Where-Object {$_.Status -ne "Mounted" -and $_.Status -ne "Healthy"}

# If LastError mentions "blocked" or "blacklisted""blacklisted"
# Check your IP reputation
# Visit: mxtoolbox.com/blacklists.aspx

# Temporary workaround: Route through different IP
# Configure smart host with clean IP

# Long-term: Request delisting and investigate cause
# Check for compromised accounts sending spam

# 1. Check queue depths decreasing
Get-Queue | Select-Object Identity, MessageCount | Sort-Object MessageCount -Descending

# 2. Verify no queues in Retry status
Get-Queue | Where-Object {$_.Status -eq "Retry"}

# 3. Check message tracking for deliveries
Get-MessageTrackingLog -Start (Get-Date).AddMinutes(-30) -EventId DELIVER |
  Select-Object Timestamp, Recipients | Format-Table

# 4. Send test message to previously affected destination
Send-MailMessage -From "admin@company.com" -To "test@partner.com" `
  -Subject "Queue Test $(Get-Date)" -Body "Testing delivery" -SmtpServer localhost

# Schedule to run every 15 minutes
$threshold = 500
$problemQueues = Get-Queue | Where-Object {$_.MessageCount -gt $threshold}

if ($problemQueues) {
    $body = "Queue growth detected:\n"
    $body += ($problemQueues | Select-Object Identity, MessageCount, LastError | Out-String)

    Send-MailMessage -To "admin@company.com" -From "alerts@company.com" `
      -Subject "Exchange Queue Alert" -Body $body `
      -SmtpServer "backup-smtp.company.com"
}